Re: H2 Implementation Debug State URI

["Poul-Henning Kamp" <[e-mail]>]

--------
In message <[e-mail]>, Cory Benfield writes:

>Brad Fitzpatrick and I ended up prototyping a sample approach for 
>getting this information out of server implementations, based on issuing 
>a GET request to a specific well-known URI. This GET would return a JSON 
>document [...]

>https://http2.golang.org/.well-known/h2interop/state and 
>https://shootout.lukasa.co.uk/.well-known/h2interop/state.

>draft here: 
>https://tools.ietf.org/html/draft-benfield-http2-debug-state-00

As I said in the workshop, this has security considerations.

A lot of people tend to forget that client side proxies exist in H2.

They may not be popular, they may not be COTS (yet), but nanny-proxies
are not going to go away when they are mandated by law in an
increasing number of contexts.

For security reasons we cannot allow this well-known-URL to be
fetched through a shared client-side proxy.

Exporting the HPACK header table gives you the other clients
cookies etc, and even exporting the streams table would
probably leak more info than acceptable.

Short of a dedicated H2 frame to get this, I don't know of any
method which can enforce this being used only hop-to-hop, which
is the only way it can be used safely.

So at the very least this needs to be firmly turned off by default
and have a major warning posted on the enabling button.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[e-mail]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.